Re: [http-state] Summary of discussion of Ticket 5 (Cookie ordering)

[Achim Hoffmann <[e-mail]>]

Dan Winship wrote on 16.04.2010 16:31:
> On 04/16/2010 06:11 AM, Achim Hoffmann wrote:
>> According application security, I already explained that web applications which
>> rely on the ordering somehow, are prone to some attacks.
> 
> Right, everyone agrees with that.
> 
>> As there is no common behaviour according this ordering in current browsers, I'd
>> recommend that the spec does not recommend the cookie ordering. This is not wrong
>> and would force web application developers to implement proper measures:
> 
> But there was already no recommended (total) ordering before, and yet

Sorry, have to disagree here.
See my (still unanswered) posting
  http://www.webappsec.org/lists/websecurity/archive/2005-11/msg00097.html
and if we look at the posting in this thread, we see that the ordering is
not unique anyhow.

IIRC the purpose is to write down the status quo today.

> some web apps did depend on IE's ordering. And the sort of developers
> who are going to write code that would depend on the exact ordering of
> cookies are the sort of developers who aren't going to read the spec
> anyway, so saying "don't assume an ordering" won't actually stop anyone.
> (Though, yes, we should say it anyway.)

:)
If the spec says "MAY have any order", they don't need to read the spec,
and security analysts can always blame the application developer without
refering the specs if something went wrong ;-)
As long as the protocol cannot ensure the correct usage (cookie odering here),
then the application developer is responsible for correct functionality of
h(is|er) application.

> Now, if it's true that there isn't a consistent ordering among the major
> browsers (which was something we didn't know at the start of the
> debate), then maybe that will be enough to solve the problem;

hmm, my first suggestion was to define a strict ordering too. But it then
has to be

  "The user agent MUST ensure following ordering: ..."

anything else is a useless attempt to get it right, but opens a wide range
of interpretations, IMHO.

> .. 5 years

damn, my posting (see above) is just 4.5 years old :-/

> ago people would test against just IE and call it good (and then blame
> Firefox if the site didn't work with Firefox), but they can't really get
> away with that any more.

Hope this helps to make the security/quality impact better understandable
for such a simple thing like "cookie odering".
Achim